Objective
Run network, monitoring, and storage services locally, each isolated in a dedicated container or virtual machine.
Architecture
Each service runs in a dedicated LXC container or virtual machine on Proxmox VE. Lightweight services (DNS, reverse proxy, monitoring, identity, security, network documentation, diagrams, cluster management) live in containers; the larger platforms, such as Immich and NethServer 8, in virtual machines.
Details
Services
List of the services hosted in the homelab.
| Service | What it is for | Where it runs |
|---|---|---|
| AdGuard Home | DNS with filtering (three instances) | Container |
| Nginx Proxy Manager | reverse proxy with certificate management | Container |
| Uptime Kuma | service availability checks | Container |
| NetBox | network infrastructure documentation (IPAM) | Container |
| draw.io | diagrams | Container |
| Immich | photo and video management | VM |
| NethServer 8 | modular server platform | VM |
| homepage | dashboard with links to the services | Container |
| homelable | network map | Container |
| Pulse | Proxmox cluster monitoring | Container |
| IT-Flow | helpdesk and ticketing | Container |
| Authentik | single sign-on and identity management | Container |
| Wazuh | log collection and security detection (SIEM) | Container |
| OpenVAS | vulnerability scanning | Container |
| OpenCanary | honeypot: detects unauthorized access attempts | Container |
| Vaultwarden | self-hosted password manager (Bitwarden-compatible) | Container |
| PegaProx | multi-cluster Proxmox VE management and monitoring | Container |
| Proxcenter | centralized cluster management | Container |
Wazuh, OpenVAS, OpenCanary, Authentik, and Vaultwarden are part of the security and identity path described in Monitoring and security. Before homepage I had tried other dashboards (including Glance): the story of that switch, along with a non-trivial CSS bug I found along the way, is in A hidden CSS bug in the homelab dashboard.
What is not published
Addresses, machine names, reachable ports, and access methods do not appear on this site: they would describe the attack surface of the network too closely.
For how these workloads are sized and distributed, see Virtual machines and LXC containers.